Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
hackeroneJ3ssieH1:579760
HistoryMay 14, 2019 - 7:48 a.m.

Django: Jenkins Unauthenticated RCE on https://djangoci.com/

2019-05-1407:48:49
j3ssie
hackerone.com
30

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.9%

JSON

This report discloses an RCE issue on djangoci.com as outlined in https://www.djangoproject.com/weblog/2019/may/15/rce-djangoci/

While technically a valid issue, it is out of scope for bounty, please see https://hackerone.com/django for details on which issues qualify for bounties.

Related

canvas 1
cvelist 3
osv 6
github 3
veracode 3
prion 3
checkpoint_advisories 3
nvd 3
cve 3
attackerkb 2
cisa_kev 2
redhatcve 3
nuclei 1
trendmicroblog 1
talosblog 1
openvas 3
nessus 2
redhat 1
thn 2
cisa 1
kitploit 1
qualysblog 1
canvas
canvas
Immunity Canvas: JENKINS_CHECKSCRIPT_RCE
2019-03-08 21:29:00
cvelist
cvelist
CVE-2019-1003029
2019-03-08 21:00:00
CVE-2019-1003005
2019-02-06 16:00:00
CVE-2018-1000861
2018-12-10 14:00:00
osv
osv
CVE-2019-1003029
2019-03-08 21:29:00
Sandbox bypass in Script Security Plugin
2022-05-13 01:00:55
Sandbox Bypass in Script Security Plugin
2022-05-13 01:00:55
github
github
Sandbox Bypass in Script Security Plugin
2022-05-13 01:00:55
Sandbox bypass in Script Security Plugin
2022-05-13 01:00:55
Deserialization of Untrusted Data in Jenkins
2022-05-13 01:01:00
veracode
veracode
Sandbox Protection Bypass
2019-05-16 03:58:57
Arbitrary Code Execution
2019-05-16 03:58:57
Arbitrary Code Execution
2019-05-16 03:23:55
prion
prion
Security feature bypass
2019-02-06 16:29:00
Security feature bypass
2019-03-08 21:29:00
Remote code execution
2018-12-10 14:29:00
checkpoint_advisories
checkpoint_advisories
Jenkins Script Security Plugin Remote Code Execution (CVE-2019-1003029)
2022-05-15 00:00:00
Jenkins Stapler Web Framework Remote Code Execution (CVE-2018-1000861)
2019-05-21 00:00:00
Jenkins Stapler Web Framework Code Execution (CVE-2018-1000861)
2020-09-21 00:00:00
nvd
nvd
CVE-2019-1003005
2019-02-06 16:29:00
CVE-2018-1000861
2018-12-10 14:29:01
CVE-2019-1003029
2019-03-08 21:29:00
cve
cve
CVE-2019-1003005
2019-02-06 16:29:00
CVE-2018-1000861
2018-12-10 14:29:01
CVE-2019-1003029
2019-03-08 21:29:00
attackerkb
attackerkb
CVE-2018-1000861
2018-12-10 00:00:00
CVE-2019-1003029
2019-03-08 00:00:00
cisa_kev
cisa_kev
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
2022-02-10 00:00:00
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
2022-04-25 00:00:00
redhatcve
redhatcve
CVE-2018-1000861
2019-12-14 04:52:17
CVE-2019-1003029
2019-03-18 11:19:55
CVE-2019-1003005
2020-04-09 10:33:39
nuclei
nuclei
Jenkins - Remote Command Injection
2021-02-20 11:11:15
trendmicroblog
trendmicroblog
This Week in Security News: Unsecured Servers and Vulnerable Processors
2019-05-17 14:14:56
talosblog
talosblog
Watchbog and the Importance of Patching
2019-09-11 09:10:37
openvas
openvas
Jenkins < 2.121.3 / < 2.138 ACL Bypass Vulnerability
2019-06-03 00:00:00
Jenkins < 2.154 and < 2.138.4 LTS Multiple Vulnerabilities - Windows
2018-12-11 00:00:00
Jenkins < 2.154 and < 2.138.4 LTS Multiple Vulnerabilities - Linux
2018-12-11 00:00:00
nessus
nessus
RHEL 7 : Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins (RHSA-2019:0739)
2019-04-11 00:00:00
Jenkins < 2.138.4 LTS / 2.150.1 LTS / 2.154 Multiple Vulnerabilities
2018-12-07 00:00:00
redhat
redhat
(RHSA-2019:0739) Important: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update
2019-04-10 18:27:43
thn
thn
New Capoae Malware Infiltrates WordPress Sites and Installs Backdoored Plugin
2021-09-21 10:08:00
Linux Botnet Adding BlueKeep-Flawed Windows RDP Servers to Its Target List
2019-07-25 09:38:00
cisa
cisa
CISA Adds 15 Known Exploited Vulnerabilities to Catalog
2022-02-10 00:00:00
kitploit
kitploit
Vulmap - Web Vulnerability Scanning And Verification Tools
2020-12-25 11:30:00
qualysblog
qualysblog
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.9%

JSON
Related for H1:579760
canvas1cvelist3osv6github3veracode3prion3checkpoint_advisories3nvd3cve3attackerkb2cisa_kev2redhatcve3nuclei1trendmicroblog1talosblog1openvas3nessus2redhat1thn2cisa1kitploit1qualysblog1